Automatic patching to every PC on day one is how a routine Tuesday update becomes a company-wide outage. Configure patch management the way professionals do: scan, watch, test, then automate.
Patch management is the feature most admins buy Endpoint Central for — and the feature that can hurt the most people the fastest when it is configured carelessly. A single untested update pushed to every machine can break the one application the business runs on. The configuration below follows the only safe order: get the patch data flowing, scan without deploying, test on a small group, then automate in rings. Skipping straight to company-wide auto-deployment is not confidence; it is gambling with other people’s working day.
“Ensure that the following TCP ports are opened on the Endpoint Central server and added to the firewall exceptions list”
This wording is from ManageEngine’s own patch knowledge base. When scans fail, the product’s maker checks ports before anything else — so should you.
A failed scan is usually a port or proxy problem, not a patch problem.
Every ring is a chance to stop. A bad patch that reaches Ring 1 costs you an afternoon; one that reaches Ring 3 costs you the week.
Rings turn patch deployment from a single leap into a staircase with landings.
Before any patch setting, confirm the plumbing. Ports 8020 and 8027 must be open on the server — ManageEngine’s own troubleshooting for failed scheduled scans starts with exactly these two ports. If your network uses a proxy for internet access, enter valid proxy credentials in the server settings: the second classic scan failure is an expired proxy password quietly stopping the patch database from updating. Fix both and most 'patch management is broken' reports evaporate.
Let the server synchronise its patch database, then run patch scans across your pilot group — scan only, no deployment. Read the results like a report card: which machines are missing what, and how old the gaps are. This scan-only phase is also your baseline evidence; when someone later asks whether patching improved security, this is the 'before' picture.
Create a small custom group — your own PC plus the pilot machines from your Scope of Management rollout. These machines should run the same everyday software as the rest of the office (browser, office suite, your business application) so a bad interaction shows up here first. Five representative PCs protect five hundred unrepresentative ones.
Now create your automatic patch deployment configuration and aim it only at the test group. Set a deployment window outside busy hours, choose how reboots are handled (notify the user, allow postponement within a limit you choose), and start with the patch categories you trust — operating system security updates first. Watch this ring for several days across at least one real Patch Tuesday cycle before widening it.
Move the tested configuration to one department, observe, then the next. Keep each ring’s deployment reports; they are your proof of what was installed where and when, and your rollback map if an update misbehaves later. Machines that must never reboot casually — billing counters, factory PCs — belong in the last ring with the most restrictive reboot policy, or in a manual-approval group of their own.
Be honest with yourself about the limit of this process: a test group reduces risk, it does not delete it. A patch can still break a rare application your pilot does not run. That is why rings, reports and reboot policies matter more than any single setting — they make a bad outcome small, visible and reversible instead of total.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoManageEngine’s own knowledge base gives the first checks: ports 8020 and 8027 must be open on the server and excepted in the firewall, and the proxy credentials in the server settings must still be valid. Those two causes cover most scan failures.
A handful — typically three to ten — chosen to mirror the real office: same Windows version, same everyday applications. Representativeness matters more than size.
For the test ring, automatic deployment of security updates is reasonable once scanning is stable. For business-critical machines, keep manual approval. The honest answer is rings: automate the safe majority, hand-check the machines whose failure stops the business.